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In this paper we investigate the security of a quantum cryptographic scheme which utilizes bal- 
anced homodyne detection and weak coherent pulses (WCP). The performance of the system is 
mainly characterized by the intensity of the WCP and postselected threshold. Two of the simplest 
intercept and resend eavesdropping attacks are analyzed. The secure key gain for a given loss is also 
discussed in terms of the pulse intensity and threshold. 
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I. INTRODUCTION 

Quantum cryptography allows two parties, Alice (the 
sender) and Bob (the receiver), to share a random bit se- 
quence, called key, which is unknown to the eavesdropper 
Eve Q. 

In the past years several quantum cryptographic 
schemes, which are mainly based on two-level quantum 
systems, have been proposed 0, 0, 0, 0, and various 
theoretical studies on the security have been published 
El El E3 ■ A conventional security measure 
of quantum cryptographic system is the secure key gain 
which represents the secure key bits gain per signal [alii- 

Recently, continuous variable quantum cryptographic 
schemes have been proposed 0, 0, 0, 15, ia hj. 
The security of those schemes is based on the commuta- 
tion relation between the quadrature amplitudes of light 
field. The quadrature measurement is implemented by 
balanced homodyne detection 0. Since balanced ho- 
modyne detection involves phase-shift operation and the 
most conventional signal source is coherent pulses, a cer- 
tain combination of phase modulations and homodyne 
detection with a coherent pulse should provide the sim- 
plest continuous variable schemes from the experimental 
side. In this point an interesting scheme is the application 
of homodyning on the phase coding four-state protocol, 
and this scheme includes a postselection process which 
is deeply related to the system performance The 
importance of the postselection is discussed in Ref. • 

In this paper we investigate the security of a quan- 
tum cryptographic scheme which uses balanced homo- 
dyne detection and weak coherent pulses [T^- In Sec. 
ITT1 we review the principles of the scheme and introduce 
basic quantities to describe the system. In Sec. IIIII we 
consider two of the intercept and resend eavesdropping 
attacks. By explicitly writing the density operator of the 
signal, all the detectable disturbances can be seen. The 
change of the quadrature probability distribution and the 
bit error rate (BER) caused by the attacks are shown. In 
Sec. IIVI we consider a beam splitting attack and then 
show the secure key gain for a given loss. 



II. QUANTUM CRYPTOGRAPHY USING 
BALANCED HOMODYNE DETECTION 

In this section we review the protocol [n| and intro- 
duce a density operator description. Then we derive the 
formula for the BER in the absence of Eve. The pro- 
tocol is similar to that of the interfcrometric quantum 
cryptography using four nonorthogonal states Q except 
quadrature measurement is performed by balanced ho- 
modyne detection with a strong local oscillator field 0] . 



A. Protocol and basic quantities 

The protocol is as follows: Alice randomly chooses one 
of the four coherent states {|a), \ia), | — a), | — ia)} with 
a > and sends it to Bob. If Alice uses a pulsed light 
source, the coherent state is the eigenstate of the annihi- 
lation operator a of the pulse mode [2(J, |2l| . Then Bob 
randomly measures one of the two quadratures {xi, £2}. 
We define the quadratrures by the relation a — x\ + 1x2, 
thus [21,2:2] = i/2. After the transmission of a large 
number of pulses, Alice and Bob communicate through a 
classical channel and they divide the resulted data into 
two parts:correci-&asis data and wrong-basis data. We 
say a pulse is correct-basis in the cases that Bob mea- 
sures i\ when Alice sent | ± a) and Bob measures £2 
when Alice sent | ± ia). The other cases, the pulse is 
called wrong-basis. For the correct-basis pulses Bob sets 
the threshold xq(> 0) and constructs his bit sequence by 
the following decision: 



(bit value) 



inconclusive 



if x > xq 
if x < ~xq 
otherwise, 



(1) 



where x is the result of Bob's measurement. Alice's bit 
values are determined by the different manner: Alice re- 
gards {\a), \ia)} as "1" and {| - a), | - ia)} as "0". 

The density operator of the signal sent by Alice is de- 
scribed by 



1 



(\a)(a\ 



a) (—a\ + \ia)(ia\ 



ia) (— ia\) . 
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(2) 



2 



where the factor \ denotes that each of the four states ap- 
pears with equal probability. Eve's task is to distinguish 
the four states. Since the four states are not orthogonal 
with each other, complete differentiation is impossible. If 
Alice announces the basis, i.e., the quadrature on which 
she encoded the bit information, then the density opera- 
tor is reduced to 

fa = ~(\a){a\ + \-a){-a\) (3) 

or 

fa = -(\ia)(ia\ + \ - ia)(-ia\) (4) 

for the announced quadrature £\ and £2, respectively. 
Thus Bob's task is in a sense to differentiate between the 



two states { \a) , \ — a) } . The decision is a practical and 
efficient implementation of this task. Although various 
differentiation tasks have been studied based on gener- 
alized quantum measurement process 0, EJ Hj| , in 
this paper we consider only the measurements which can 
be realized by conventional optics and detectors. 

For a quantitative description, it is convenient to in- 
troduce the probability density that the outcome x§ is 
obtained by measuring £ t j > = £\ cos0 + £2 sin0 of a co- 
herent state I a) 

I (cc^|ct) | 2 = y^ cx P [-2(ai0 - acos^) 2 ]. (5) 

Then the probability distribution of quadrature mea- 
sured by Bob is written as 



ji- {exp [-2(xi - a) 2 ] + exp [-2{x % + a) 2 ] } if i = j 



\Pj\ 



(6) 



exp 1 



-2x 2 



if i ^ j, 



with i.j = 1,2 (see Fig. UJ. i — j 'is for correct-basis B. Postselection efficiency and bit error rate 

pulses and i ^ j is for wrong-basis ones. If Alice an- 
nounces the states she sent, Bob observes the quadrature 
distributions for the coherent states (see Fig. [TJ. The 
quadrature distributions represent the conditional prob- 
ability that characterizes the signal detection and thus 

any detectable disturbance should appear on the distri- We define the postselection efficiency as the probabil- 
butions. ity that the absolute value of correct-basis pulse's quadra- 

Since we can treat the quadratures x\ and £2 equally, ture \x\ exceeds the threshold xq. With this probability a 
hereafter we consider only the cases that Bob measures correct-basis pulse gives a bit value according to decision 
£\. Then we refer |±a) as correct-basis pulses and \ ±ia) (JIJ. The postselection efficiency in the absence of Eve is 
as wrong-basis pulses. written as 



P(x ,n) 



(xi\pi\xi)dxi + (a;i|/5i|a;i)dxi 

-OO J XQ 

j erfc V2 (xq + \fn) 4- erfc y/2 (xq - y/n) j | 



(7) 



r 



where 



erfc (a;) 



exp (~t 2 )dt, 



(8) 



and n = a 2 is the pulse intensity (the mean photon num- 
ber per pulse). If xq — 0, then every correct-basis pulse 
gives a bit value, thus P(0,n) = 1 for any n > 0. For a 
given xq the BER can be written as the probability that 



Bob's measurement of £\ results an outcome x\ < —xq 
when Alice sent the state |a) divided by P(xo,n) 



q(x ,n) 



1 



P(xo,n) 
1 

2^X0,71) 



erfc 



|(a;i|a)| 2 dx 
V2 (x + y/n) 



(9) 
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1.00 




between Xi and x 2 determines the most probable state 
as follows: 



0.00 J 



-3.0 -2.0 -1.0 0.0 1.0 2.0 3.0 

quadrature x 

FIG. 1: The quadrature distributions for correct-basis 
(xi\pi\xi) , wrong-basis (xi\p2\xi) pulses and the coherent 
states |(a;i| ± a}\ 2 for the pulse intensity n = a 2 = 1 in the 
absence of the eavesdropper. The correct-basis and wrong- 
basis distributions are observed after Alice's announcement 
of the basis. In contrast to this, the distributions for the co- 
herent states cannot be observed until Alice announces the 
states, and the announcement of the states sacrifices the key 
bits. The bit errors originate from the overlap between the 
Gaussian distributions |{a;i| ± a}\ 2 and they are mainly dis- 
tributed around x = 0. Bob can efficiently cut out some of 
these bit errors by introducing the threshold xo and discard- 
ing the inconclusive results ( < xo) when he constructs the 
key bits. 



P and q are decreasing functions of xq ■ This means that 
Bob can obtain smaller BER sacrificing the efficiency by 
raising the threshold value. 

Because the BER is a function of n and xo, the se- 
curity of the system depends on a priori selected n and 
postselected xq. The parameters should be determined 
so that the system provides higher security. For this pur- 
pose we consider the simplest eavesdropping attacks in 
the following sections. 



III. EAVESDROPPING: INTERCEPT AND 
RESEND 

In this section we consider two of the intercept and 
resend eavesdropping attacks. The density operators of 
the disturbed signals are explicitly shown and then the 
quadrature distributions and BERs are obtained. 



A. Simultaneous measurement attack 

Here we show the effects of a simultaneous measure- 
ment attack as a function of n. Eve's strategy is as fol- 
lows. She splits the signal into two pulses of half intensity 
by using a 50:50 beam splitter (BS) and measures x\ of 
one pulse and x 2 of the other pulse. Then Eve obtains 
a pair of values (x\,x-2) for each signal. The inequality 




if ii > |x 2 | 
if x 2 > \xi\ 
if -xi > \x 2 1 
if -X2 > \xi\ 



(10) 



Thus Eve resends the signal to Bob according to this de- 
cision. It should be noted that the extra noise of simul- 
taneous measurement is minimized in this measurement 
for the case of a coherent state 0, |25|, however, this 
does not mean that this measurement gives the optimal 
differentiation of the four states. 

To write down the density operator of Eve's resending 
signal, let us consider the case that Alice sent \a). The 
probability that Eve gets an outcome (x±, X2) is given by 
the product of the two quadrature distributions for the 
split coherent states 



(5i,$ 2 ) 







2 




(xi 


—) 

V2/ 




(x2 



a 

V2 



X 1 =X 1 ,X 2 = X2 



2 

— exp 



-2 x 



- -2xi 



(11) 



The resending signal can be characterized by three prob- 
abilities p + , p± , and p- : The first one is that Eve resends 
the original state \a) correctly 

P+(n) = / Qn(xi, x 2 )dxidx 2 - (12) 

J x t >\x 2 \ 

The second one is that Eve resends either of 7r/2-phase- 
shifted states | ± ia) 

p±(n) = / Q n (x 1 ,x 2 )dx 1 dx 2 . (13) 

J x 2 >\x t \ 

The last one is the probability that Eve resends the 7r- 
phase-shifted state | — a) 



p-(n) = / Q n (x 1 ,x 2 )dx 1 dx 2 . (14) 

J -xt>\x 2 \ 

Consequently, the original state is transformed as 
\a){a\ -> 

p+\a)(a\ +p-\ - a)(-a\ 
+p± (\ia)(ia\ + \ — ia)(— ia\) . (15) 

The quadrature distribution of this signal for re = 1 is 
shown in Fig. [5] 

As a result, Bob's density operators after Alice's an- 
nouncement of the basis, say p\ and p 2 , are expressed 
as 



Pi = (P+ +P-)h + 2p±/5 2 , 
P 2 = 2p±Pi + (p+ +P-)h- 



(16) 
(17) 
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— I<*,|a>l 

- - simultaneous measurement 
■ - intermediate basis 




-1 1 
quadrature x 



In these formulas the terms including p± indicate the 
part where Eve encodes the bit information on the wrong- 
basis. The quadrature distributions for the correct-basis 
pulse and wrong-basis pulse are given by (xi\p[\xi) and 
(xi\p' 2 \xi), respectively (see Fig. |3J). A remarkable point 
is that Bob observes the effects of eavesdropping in the 
wrong-basis data as well as in the correct-basis data. 



To calculate Bob's BER in the presence of Eve, we 
rewrite the postselection efficiency 



FIG. 2: Disturbed quadrature distributions for the pulse 
intensity n = 1. The solid line shows the quadrature distri- 
butions in the absence of Eve |(a;i|a}| 2 . The dotted line is for 
the simultaneous measurement attack, and the dashed line 
is for the intermediate basis attack. These distributions are 
observed if Alice announces the states. 




quadrature x 



FIG. 3: The correct-basis distributions and wrong-basis ones 
for n = 1. The solid lines are for the absence of Eve. The dot- 
ted lines describe the case that Eve performs the simultaneous 
measurement; the curve that has the maximum at x — is 
for wrong-basis pulses. The dash-dot line represents the re- 
sult of the intermediate basis attack, where the correct-basis 

and wrong-basis distributions take the same form. With tMs equation we obtain Bo b's BER 



(!) ( \ 



' p+ I \(xi\ - a)\ 2 dx +P- / \{xi\a)\ 2 dx + 2p±_ / {xi\p 2 \x{)dx 



-— ^ (p + erfc V2 (x + ^/n) + p_ crfc V2 (x - ^/n) + 2p± erfc ( V2xq] \ 

2P' w (x ,n) L L J L -I \ /J 



(19) 



After the classical communication Eve may know the basis on which Alice encoded the bit information for 
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0.0- 



0.0 0.5 1.0 1.5 2.0 2.5 3.0 
pulse intensity n (photon/pulse) 

FIG. 4: The BERs as functions of the pulse intensity n for 
the threshold xo = 0. The solid line is Bob's BER in the ab- 
sence of Eve q(0,n). The dash-dot line shows Bob's BER 
for the simultaneous measurement attack q^g(0,n). The 
dashed line is for the intermediate basis attack ?ss(0, n). 
The dotted line is Eve's BER for the two of the attacks 
qg(Q,n) = 4 2) (0,™) =«(0,n/2). 

each pulse, and Eve's information is determined by the 
quadrature value of split signal measured in the "correct- 
basis" . Thus Eve's BER is q [ E ] (0, n) = g(0, n/2) (see Fig. 
0}. Note that Eve's threshold is always zero because she 
cannot select the parts of the data that contribute to the 
key bits. 



B. Intermediate basis attack 

Here we consider an eavesdropping strategy that Eve 
measures the intermediate basis operator x^/4 = Xl ^ 2 ■ 
In the case that Eve performs single homodyne detection 
for each pulse, the intermediate basis minimizes her BER 
on the average. 

(2) 

By measuring x^u, Eve obtains her BER q E (0, n) = 
^(0, n/2). Since she has no information about Alice's 
choice of the basis, she encodes the bit information on 
the intermediate basis when she resends the pulse to 
Bob. Namely, Eve resends \a exp(«7r/4)) if the outcome 
%it/4 ^ and | — aexp(«7r/4)) otherwise. This operation 
transforms the four states as 



| ± a)(±a|, | ± ia)(±ia\ — > 

(1 - q E )\ ± ae^/ 4 )(±ae"/ 4 | + q E \ T ae l7r / 4 )(Tae^ 4 |. 

(20) 



An example of the resulted quadrature distributions is 
shown in Fig. [21 It yields the same distribution for the 
correct-basis pulse and wrong-basis pulse (see Fig. 121 . 
This feature originates from the fact that Eve has no 
information about Alice's choice of the basis. 

From transformation l|2U|) . Bob's postselection effi- 
ciency is given by 





(xilae^ 4 ) 


2 

+ 


(xi|-«e M / 4 ) 


1x0 \ 









= P(x ,n/2). 

Then, considering the case that Alice sends \a) and Bob gets x\ < —xq we obtain Bob's BER (see Fig. QJ: 



(21) 



( 2 ) / <i 



P /{2) (x ,n) J- 
[1 - q E (n)]q(x ,n/2) 



dx ( [1 - qE(n) 
<lE(n) 



2P' (2) (z ,n) 
I 



ixi \ae 



erfc 



Z7T/4 



+ qE(n) 
V2 (x - \/n/2\ 



[xi \ — ae 



t/4\ 



(22) 



As shown in Fig. [21 the non-Gaussian distribution re- 
veals the presence of Eve. This feature can also be seen 
in the wrong-basis distribution in Fig. [31 The monitor- 
ing of the wrong-basis distribution profile restricts Eve's 
operation. For instance, suppose that Eve resends a co- 
herent state for each pulse. Then the density operator 
after Alice's announcement of the basis can be written 



as the mixture of coherent states 

p' 2 = J2^0)\re^)(re w \, (23) 

with ~YjW(r,6) = 1, w(r,6) > 0, 

for r > and — it < 8 < ir. 

If Bob observes no disturbance in the wrong-basis distri- 
bution, i.e., (xi\p' 2 \xi) = (xi\p2\x\), we find the condi- 
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tion w(r, 8) = for all 8 ^ ±7r/2. The trivial solution 
which satisfies this condition is that Eve resends the vac- 
uum state [w(r, 8) = for r ^ 0] which induces Bob's 
BER of 0.5. The other solutions require that Eve distin- 
guishes between p± and p2 without error. Similarly, the 
monitoring of the correct-basis distribution profile gives 
additional limitations on Eve's operation. 

Although the security proof needs more analysis about 
Eve's operation and leaked information, most of the at- 
tacks cannot work provided Bob observes the distribu- 
tions carefully. An undetectable attack is the beam split- 
ting attack shown in the next section. 



IV. SECURE KEY GAIN FOR A GIVEN LOSS 

For any practical implementation of quantum cryptog- 
raphy, the transmission loss is an unavoidable problem 
jlTM. flll | . The loss weakens the signal intensity and in the 
same time it potentially causes the information leakage to 
Eve. In order to estimate the performance of the system 
for a given loss, we consider a beam splitting attack and 
calculate the secure key gain which gives the secure bits 
gain per signal [j| Q . The threshold and pulse intensity 
can be selected to maximize the secure key gain. 

We assume that (1) Eve has a lossless optical fiber, 
and (2) Eve can store the light pulses for an arbitrar- 
ily long time before measuring them. Then Eve replaces 
the original transmission path with her lossless fiber and 
splits the pulse using an asymmetric BS with reflection 
efficiency 1 — 77 which is equal to the original transmis- 
sion loss, so that Eve does not change the pulse intensity 
received by Bob. Further, she measures her split signal 
in the correct-basis by delaying her measurements until 
she have received the basis information. 

After the error correction Alice and Bob share the same 
bit sequence, thus the question is how well are the out- 



comes of Eve's measurements correlated to the transmit- 
ted states. The correlation is estimated by the relative 
expected collision probability P c which determines the 
fraction r = 1 + log 2 P c , by which the bit se quen ce is 
shortened in the privacy amplification process |2g. Fi- 
nally, Alice and Bob can bound Eve's Shannon informa- 
tion about the key by discarding s bits, 



Ie< 



In 2' 



(24) 



Let us consider the signal transmission that the binary 
signals {\a), | — a)} are sent and the homodyne detection 
J dxi\xi)(xi \ is performed. The collision probability for 
the beam splitting attack is determined as follows: Ac- 
cording to Q, the relative expected collision probability 
can be written as 



ft = EE 



0=±a xi 



Prob(xi) ' 



(25) 



where p{x\,(3) is the joint probability of the sent signal 
|/3) and the measured quadrature value x\, and Prob(a;i) 
is the probability that the measurement results x±, 



Prob(xi) = (xi\pi\xi) 



(26) 



The conditional probability that the state is |a) when the 
measurement results x\ is given by 



Prob(a|iEi) 



\( Xl \a)\ 2 + \{ Xl \-a)f 



(27) 



Then we obtain the joint probability by the product 
p{x\,a) = Prob(a|a;i) Prob(iEi). Thus the fraction is 
written as a function of the pulse intensity n = a 2 : 



dx- 



r(n) = l + log 2 P t 
= l + log 2 



where we replaced the x\ summation to the integration dx\. 

Using this expression we obtain the secure key gain (with ideal error correction) 



exp 


-4 (x - y/n) 2 ' 


+ exp 


-4(x- 


1" V™) 2 ' 


exp 


-2 (X - y/Ef 


+ exp 


-2(x- 





where 



G{x ,n,T]) = -P(x ,r]n) [I AB {x ^n) - r((l - 77)71)] 



Iab(x , n) = V ^ TOb( - a: | [l + Prob( v / ^|a;) log, Prob(v^|x) + Prob(- v 7 ^) log, Prob(- v / ^|3 
^ P{x ,n) 



\x\>xo 



(28) 



(29) 
(30) 



is the mutual information between Alice and Bob 0,0, and (1 — rj)n is the lost pulse intensity received by Eve, 
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d-4- \ 



-5- 1 -, . , ■ , ■ , ■ , . , 

0.0 0.2 0.4 0.6 0.8 1.0 
loss 1-77 



FIG. 5: The secure key gain G as a function of the loss 
1 — 77 for the pulse intensity n = 1 and the threshold values 
xo = 0,0.3,0.5,1.0,1.5. 

and 7771 is the pulse intensity received by Bob. The loss 
region where the secure key is obtainable is defined by 
G > 0. The region is determined by the sign of Iab — t 
because P is always positive. Since Iab is an increasing 
function of Xq and Iab ~ > l(^o — > 00 )? it is always pos- 
sible to find a sufficiently large value of xq that satisfies 
G > for any 77 > and n > if r < 1. 

Typical behavior of G as a function of 1 — ry for a fixed 
n is shown in Fig. 03 For a given value of Xq, G rapidly 
vanishes at a certain value of 1— 77. By raising the value of 
xq we can extend the loss region where the secure key is 
obtainable. For fixed n and 1 — 77, P is a decreasing func- 
tion of xq and Iab is an increasing function of xq. Thus, 
the trade-off between P and Iab determines the optimal 
threshold which maximizes G [see Fig. EJa)]. Then by 
comparing G for various n at the optimal threshold, we 
can optimize n and xq simultaneously to maximize G for 
a given value of 1 — 77. The optimal value is G = 0.27 
(x = 0.22, n = 0.89) for 10% loss, G = 4.0 x 10~ 2 
(af = 0.64, n = 0.62) for 50% loss, and G = 6.0 x 10~ 6 
(x = 1.91, n = 0.59) for 90% loss. Figure EJb) shows 
G for several values of n at the optimal threshold as a 
function of 1 — 77. 

The limitation for the key gain against the beam split- 
ting attack under the assumption that Eve can use a 
positive operator valued measure for the split individual 
pulse is presented in Ref. |27|. 

V. CONCLUSIONS AND REMARKS 

We investigated the security of quantum cryptography 
using balanced homodyne detection. For the two of the 
intercept and resend attacks, we derived the disturbed 
density operator of the signal and showed the quadrature 
distributions and BER as functions of the pulse intensity 



and postselected threshold. Both of the attacks are de- 
tectable only by the monitoring of the wrong-basis dis- 



g n (photon/pulse) 

-g 0.1 0.75 

O 5- 0.2 




FIG. 6: (a) The optimal thresholds for the values of the pulse 
intensity n — 0.1, 0.2, 0.5, 1.0, 1.5, 2.0 as functions of the loss 
l — ?7. (b) The key gain G at the optimal threshold. 

tribution profile. Our examples show that Eve's possible 
operations are greatly restricted if she does not disturb 
the quadrature distributions. However, in our formula, 
which describes only the signal density operator, the re- 
lation between the observed signal disturbance and po- 
tentially leaked information is unclear. Further analysis 
needs more general description. 

We presented the secure key gain for a given loss, pro- 
vided Eve performs a beam splitting attack. We can 
extend the loss region where the secure key is obtain- 
able by raising the threshold value. The pulse intensity 
and threshold can be selected to maximize the secure key 
gain. 
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